Quantum computing and cybersecurity: getting ready for post-quantum cryptography

A large quantum computer would break the public-key cryptography that protects most of the internet. The replacements already exist, and the time to plan the move is now.

Most secure communication today relies on public-key cryptography such as RSA and elliptic-curve cryptography. Their security rests on mathematical problems, factoring large numbers and computing discrete logarithms, that are impractical for classical computers to solve at the key sizes in use.

In 1994 Peter Shor showed that a sufficiently large, error-corrected quantum computer could solve both problems efficiently. No such machine exists yet, and estimates of when one might vary widely. But the risk does not begin on the day it is switched on.

Harvest now, decrypt later

Encrypted data can be recorded today and stored until it can be decrypted. Anything that must stay confidential for many years, such as health records, government information, intellectual property or personal data, is already exposed to this risk. Digital signatures face a related problem: if signing keys can be broken in future, documents and software updates signed today may no longer be trustworthy.

What is and is not affected

Public-key encryption and key exchange (RSA, Diffie–Hellman, elliptic-curve methods) would be broken by Shor’s algorithm.
Digital signatures based on RSA or elliptic curves, including ECDSA as used by many blockchains, would also be broken.
Symmetric encryption such as AES and hash functions such as SHA-256 are much less affected. Grover’s algorithm gives at most a square-root speed-up, which longer keys and outputs, such as AES-256, address.

The replacements are ready

In August 2024 the United States National Institute of Standards and Technology published its first post-quantum cryptography standards: FIPS 203 (ML-KEM) for key establishment, and FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for digital signatures. These algorithms run on ordinary computers and are designed to resist both classical and quantum attacks. In Australia, the Australian Signals Directorate has advised organisations to plan to stop using traditional asymmetric cryptography by the end of 2030.

Where to start

Make an inventory of where and how your systems use cryptography, including in third-party products and hardware.
Identify data that must stay confidential for years, and prioritise the systems that protect it.
Ask vendors for their post-quantum plans and timelines.
Build crypto-agility: design systems so algorithms can be replaced without rebuilding everything.
Test hybrid schemes that combine a classical and a post-quantum algorithm during the transition.

Migrating cryptography across an organisation takes years, and past migrations have taken longer than planned. Organisations that start the inventory now will be able to make the move on their own timetable rather than in a hurry.